How to buy bitcoin safely: a licensed exchange and your own wallet

Choose an exchange licensed under MiCA, move the coins to a wallet only you control, and check every address before you send. Plus the scams to know.

By Dimitar Zurnov · Updated 11 Oct 2026

If you decide to buy bitcoin, buy it from an exchange licensed under the EU's crypto law (MiCA), then move it to a wallet where only you hold the keys. Before every send, check the address on the wallet's own screen.

Scams are where the big losses are. Americans reported $11.4 billion in crypto-related losses to the FBI in 2025, and fake investments were $7.2 billion of that (IC3 2025 report, pp. 52 and 53).

This guide is education, not financial advice.

Who can legally sell you bitcoin in Bulgaria?

An exchange, or any other firm that offers crypto services in Bulgaria, needs a licence under MiCA (Regulation (EU) 2023/1114). Firms that already worked under national rules could go on until 1 July 2026 (Article 143). Bulgaria used the whole period (FSC FAQ). From that date, the Financial Supervision Commission (FSC) says, only licensed providers may offer crypto services (FSC, 2 July 2026).

A licence from any EU country counts, as long as it covers Bulgaria. The EU securities regulator, ESMA, keeps one register of every licensed provider and the countries each may serve (ESMA MiCA register).

We counted ESMA's list on 11 October 2026, keeping every licence with no end date and counting each company once. 363 providers held such a licence, and 173 of them were licensed in Bulgaria or listed it among the countries they serve. Five of them are licensed in Bulgaria itself, the same five as in the FSC's own register.

To check an exchange:

Open ESMA's list of licensed providers (a CSV file).
Search for the company's legal name, which is in the app's terms or the website's footer. The brand name can differ.
Look for BG in the row's list of countries.

The FSC also publishes a separate register of crypto firms under the transitional rules. An entry there is not a licence: the FSC says those firms may not provide crypto services (FSC). The FSC has also warned of crypto companies taken over by strangers registered as their managers, without the real owners knowing (FSC, 3 February 2026).

Should you leave your bitcoin on the exchange?

Not for long. On an exchange you hold a promise, not coins: the exchange holds the keys. If it fails, you wait in line with everyone else it owes.

That has happened. Mt. Gox, once one of the largest bitcoin exchanges, filed for bankruptcy protection in Tokyo in February 2014 (AP via MPR News). In 2022 the US Securities and Exchange Commission charged FTX's founder over "the undisclosed diversion of FTX customers' funds" to his trading firm (SEC). A licence adds rules and oversight. It does not make a failure impossible.

So once you have bought, withdraw to a wallet of your own. Bitcoiners have a saying for it: not your keys, not your coins.

Your own wallet gives you a recovery phrase, usually 12 or 24 words (BIP 39). Those words control the bitcoin. Write them on paper, keep them offline, and never type them into a website or a chat. "Any backup that is stored online is highly vulnerable to theft," as Bitcoin.org puts it. A hardware wallet keeps the keys on a separate device, which is worth it once the amount would hurt to lose.

Expect one extra step when you withdraw more than €1,000 to a wallet you control. EU rules require the exchange to assess whether that address is yours (Regulation (EU) 2023/1113, Art. 14(5)). So it may ask you to show that the wallet is yours. That is normal.

How do you check a Bitcoin address before you send?

Check it on the screen of the wallet that will receive it, character by character, not just the first and last few. On a hardware wallet, its own screen is the one to trust (Trezor).

Bitcoin addresses carry a checksum that catches typing mistakes. A modern address starting with bc1 detects any error in up to four characters (BIP 173). Older addresses starting with 1 or 3 carry a checksum too, and the Explore21 search checks both kinds. Search for the genesis address with its last letter changed, 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNb, and it answers: "one character is off: its checksum doesn't match."

A checksum cannot catch a whole address swapped for another valid one. Two scams do exactly that:

Clipboard malware replaces the address you copied with the attacker's (Bitcoin.org).
Address poisoning sends you a tiny payment from an address that looks like one you use, hoping you copy it from your history later (Bitcoin.org). One study counted at least $83.8 million lost this way on two other blockchains in two years (Tsuchiya et al., USENIX Security 2025).

So copy the address fresh from the receiving wallet every time, never from your history, and compare it on the wallet's screen. A small test payment first is a good habit too, but it does not stop poisoning on its own.

After you send, open the address on Explore21. The amount shows as "Waiting" until a miner puts it in a block, then counts as confirmed. If it waits for hours, see how to speed up a stuck transaction.

Which scams take the most money?

Fake investments do, by far. The FBI received 61,559 complaints about crypto investment fraud in 2025, with $7.2 billion lost. People over 60 lost $4.4 billion to crypto scams of all kinds (IC3 2025 report, pp. 52 and 53). Chainalysis traced at least $14 billion sent to scammers on the chains themselves in 2025 (Chainalysis).

The ones to know:

The new friend with a great platform. A stranger by text, social media or a dating app builds trust, then shows you a trading site with growing profits. The site is fake, and so are the profits (IC3, p. 11).
"Support" that asks for your recovery phrase. Never share it with anyone, as Trezor puts it. Scammers pose as support staff for wallets and exchanges (Bitcoin.org).
Fake apps and websites. Copies of real wallets and exchanges, sometimes shown as sponsored search results, steal the phrase or password you type in (Bitcoin.org). Open your exchange from a bookmark, and download a wallet only from the link on its maker's own site.
Giveaways. "Send 0.1 BTC, get 0.2 back", often with a fake video of a famous name (Bitcoin.org).
Pay us in crypto, at an ATM. No government office, police or utility will ask you to pay in crypto (FTC). Americans lost $389 million through crypto ATMs in 2025 (IC3, p. 53).
Recovery services. After a loss, someone offers to get the coins back for a fee. No real firm can guarantee that (Bitcoin.org).

Each of these scams works by getting you to send, or to type in your recovery phrase. A sent bitcoin payment cannot be reversed.

Which exchange do I use?

I buy on Strike, for three reasons.

Recurring buys, free after the first week. Strike offers recurring buys, often called DCA: a fixed amount bought on a fixed schedule, hourly to monthly. After the first week they carry no fee (Strike). I buy bitcoin for the long term, so a small amount on a schedule suits me.
My coins go to my own wallet. Withdrawing to cold storage is part of the service, and I move my coins there, because not your keys, not your coins.
It is licensed for Bulgaria. Strike is licensed in Malta since 25 June 2026 as Zap (Strike) Europe Limited, and its row in ESMA's list includes Bulgaria. I checked that row myself, as the steps above describe.

As on any exchange, the price you pay still includes a spread (Strike's commercial policy). Fees and terms can change, so check them on Strike's site before you sign up.

This is my personal choice and my own reasons. It is not financial advice, and not a recommendation for you. Neither Explore21 nor I get anything from Strike for this mention.

A safe first purchase, step by step

Pick an exchange, and find its legal name and BG in ESMA's list.
Set up your own wallet, and write the recovery phrase on paper.
If you decide to buy, try the whole route with a small amount first.
Copy the receiving address fresh from your wallet and check it on the wallet's screen.
Withdraw, then watch the address on Explore21 until the amount is confirmed.
Never share the recovery phrase, and never send to anyone who contacted you first.

Sources

More to learn

Something look wrong? Tell us